panda_pal 5.16.5 → 5.16.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed57241456e0fe78d006855d50152d47c8a328b777bf77d16b53e0a59519e766
-  data.tar.gz: '0748669e4a1e3a83f9e8653b08f8c200b755d9b41a0b61e4dda1b83dbd8859c5'
+  metadata.gz: 2dc69090531d872e50b4bf8414fdca02abaeada29fb82a0da811f3c3cfce95dc
+  data.tar.gz: 86dda2b637be102247d9d400437e2c8a641287ef6003a47a72cfaac2ad3ee82e
 SHA512:
-  metadata.gz: 5bb3ebb3379973fe51332a46807d6e69c55e4134cca476829231dd3539cdfc21e02af95a91dd32300b4bcd54018dd17061f144318b06577d4f33fae44c5a8ee6
-  data.tar.gz: 7f924b2f17246b33c5b535c80e0fd6ebef89ccd450d4c78687ae93d2247324ffacb4e8e58c99cfd92f7604ece73e8ebbbd9903af037fa1afa96f8c2063ced03d
+  metadata.gz: 93dab2296f05be33a67c346b1fd61c7e62de04e714f9dfae1d88cb40b1123794453e3093e0c81fd147f5fb29c189d41b7e0454c76abbbf70dc1d845a1454e473
+  data.tar.gz: 8df5d04c2bbe0b62ff302dd1115b70650cd16bb940013b62cc404014aff0046fe0e9afc016d679d4cb63d852dc63169df1bacdaacde7d28adace939ad4028a13

data/README.md

@@ -38,10 +38,26 @@ LTI 1.3 has some additional configuration steps required to setup an LTI:
 
 1. If you're running Canvas locally, make sure the `config/redis.yml` and `config/dynamic_settings.yml` files exist in Canvas.
 2. Also make sure `config/security.yml` is present and set `development.lti_iss` to `'http://localhost:3000'` (where 3000 is the port you're running Canvas on).
-3. In prod, you'll need to generate a RSA Private Key for the LTI to use. You can set the `LTI_PRIVATE_KEY` ENV variable, or manually set `PandaPal.lti_private_key = OpenSSL::PKey::RSA.new(key)`.
+3. In prod, you'll need to generate a RSA Private Key for the LTI to use. You have several options:
+   - Set the `LTI_PRIVATE_KEY` environment variable with the PEM-encoded private key content
+   - Set the `LTI_PRIVATE_KEY_PATH` environment variable with the path to your private key file (relative to Rails.root or absolute path)
+   - For encrypted private keys, set the `LTI_PRIVATE_KEY_PASSWORD` environment variable with the decryption password
+   - Manually set `PandaPal.lti_private_key = OpenSSL::PKey::RSA.new(key)`
 4. Make sure you have Redis installed and linked correctly
 5. Your PandaPal::Organization's `key` should be `CLIENT_ID/DEPLOYMENT_ID` (which can be found in Canvas). If a Deployment ID is not given, the key should just be `CLIENT_ID`.
 
+
+To generate an encrypted private key using OpenSSL:
+```bash
+# Generate new encrypted private key
+openssl genrsa -aes256 -out encrypted_private_key.pem 2048
+
+# Or encrypt existing private key
+openssl rsa -aes256 -in existing_private_key.pem -out encrypted_private_key.pem
+```
+
+**Note**: The private key file path supports both relative paths (relative to Rails.root) and absolute paths.
+
 ### Launch URL property
 LTI Spec: `The launch_url contains the URL to which the LTI Launch is to be sent.   The secure_launch_url is the URL to use if secure http is required.  One of either the launch_url or the secure_launch_url must be specified.`
 

data/config/initializers/apartment.rb

@@ -259,6 +259,36 @@ ActiveSupport.on_load(:action_cable) do
     def tenant
       @tenant || 'public'
     end
+
+    def panda_session
+      unless defined?(@panda_session)
+        @panda_session = PandaPal::Session.for_request(request, enforce_tenant: :switch)
+        @tenant ||= Apartment::Tenant.current
+      end
+      @panda_session
+    end
+  end
+
+  ActionCable::Channel::Base.module_eval do
+    delegate :panda_session, to: :connection
+
+    if defined?(CanCan)
+      set_callback(:subscribe, :around) do |_, blk|
+        blk.call
+      rescue CanCan::AccessDenied
+        reject
+      end
+
+      delegate :current_ability, to: :connection
+
+      def authorize!(*args, **kwargs)
+        current_ability.authorize!(*args, **kwargs)
+      end
+
+      def authorized?(*args, **kwargs)
+        current_ability.can?(*args, **kwargs)
+      end
+    end
   end
 
   # Include the Current Tenant in any broadcastings
@@ -281,7 +311,7 @@ ActiveSupport.on_load(:action_cable) do
   end
 
   # Lazily switch any worker threads to the correct tenant when they are working
-  #   Actively calling `switch_tenant` for checks out a DB connection and calls `SET search_path`.
+  #   Actively calling `switch_tenant` checks out a DB connection and calls `SET search_path`.
   #   The message processing may not interface with the DB, so this would be a huge waste.
   #   Instead, we ensure that the thread will trigger a :checkout if it needs a connection,
   #     at which time we hack-in the correct tenant/schema.

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.16.5"
+  VERSION = "5.16.7"
 end

data/lib/panda_pal.rb

@@ -76,11 +76,19 @@ module PandaPal
   def self.lti_private_key
     key = @@lti_private_key.presence
     key ||= ENV['LTI_PRIVATE_KEY'].presence
+
+    if key.blank? && ENV['LTI_PRIVATE_KEY_PATH'].present?
+      key_path = File.expand_path(ENV['LTI_PRIVATE_KEY_PATH'], Rails.root)
+      key = File.read(key_path) if File.exist?(key_path)
+    end
+
     key ||= File.read(File.join( File.dirname(__FILE__), "../config/dev_lti_key.key")) if Rails.env.development?
     return nil unless key.present?
 
-    key = OpenSSL::PKey::RSA.new(key) if key.is_a?(String)
-    key
+    return key unless key.is_a?(String)
+
+    password = ENV['LTI_PRIVATE_KEY_PASSWORD']
+    OpenSSL::PKey::RSA.new(key, password)
   end
 
   def self.lti_private_key=(v)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.16.5
+  version: 5.16.7
 platform: ruby
 authors:
 - Instructure CustomDev